Re:Is RAM wiped before use in another LXC container?
by the8472 on Wednesday April 05, 2023 @10:37AM
(#35455008)
glibc uses vfork+exec to implement posix_spawn, which makes it much faster than fork+exec.
[ Parent
| on HN ]
Re:Is RAM wiped before use in another LXC container?
by panzi on Wednesday April 05, 2023 @09:30PM
(#35462938)
Yes, of course. Did remember its not fork(), but some other *fork() and couldn't remember the name. But just the kind of thing it does. Its also not exec(), but probably execvp() or execvpe() or something like that.
Re:Is RAM wiped before use in another LXC container?
by seba_dos1 on Friday April 07, 2023 @06:34PM
(#35487930)
It's important to note because vfork is exactly what makes it close to posix_spawn, as opposed to regular fork.
Re:Is RAM wiped before use in another LXC container?
by panzi on Friday April 07, 2023 @07:33PM
(#35488528)
When using vfork() what are you allowed to do? Can you even do IO redirection (piping)? The man page says:
> ... the behavior is undefined if the process created by vfork() either modifies any data other than a variable of type pid_t used to store the return value from vfork() ...
But the time between fork and exec is exactly where you do a lot of setup, like IO redirection, dropping privileges, setuid(), setting a signal mask (nohup) etc. and I don't think you can do that without setting any variables. You certainly write to the stack when calling a function.
If you can't do these things you can't really use it to implement posix_spawn(). I guess it could use vfork() in the case no actions are required, but only then.